Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-08-2024 06:22
Static task
static1
Behavioral task
behavioral1
Sample
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe
Resource
win10v2004-20240802-en
General
-
Target
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe
-
Size
1.8MB
-
MD5
f3ef6ea2a9629f605bb4c6bdd197b3e1
-
SHA1
ffc67e08bf3897b3b6d8eb45150ddfab9d11ce96
-
SHA256
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0
-
SHA512
3e769090ab70a81bcf37e01701ff1e1f6081c3258e65dc25d16f19ac7804ffbbc0823229bc765465d0c7a7e24514524a9a007d6919a2fe098d6be026ac3c44c5
-
SSDEEP
49152:gIVv4/yD9/yNR5cZF/Tu1klo6iVRAZJsAiQ6:LVPR/1ZFr3oFVRqGk
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
explorti.exeexplorti.exeexplorti.exef1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe -
Executes dropped EXE 7 IoCs
Processes:
explorti.exe7c1ec43858.exe9cf13c5d16.exe9fd1a2f5ad.exeexplorti.exeexplorti.exeexplorti.exepid process 3860 explorti.exe 3632 7c1ec43858.exe 3776 9cf13c5d16.exe 4864 9fd1a2f5ad.exe 3980 explorti.exe 1928 explorti.exe 5628 explorti.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explorti.exeexplorti.exeexplorti.exef1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Run\7c1ec43858.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\7c1ec43858.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4768-45-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/4768-43-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/4768-47-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exepid process 3068 f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe 3860 explorti.exe 3980 explorti.exe 1928 explorti.exe 5628 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
7c1ec43858.exe9cf13c5d16.exedescription pid process target process PID 3632 set thread context of 4768 3632 7c1ec43858.exe RegAsm.exe PID 3776 set thread context of 3608 3776 9cf13c5d16.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exedescription ioc process File created C:\Windows\Tasks\explorti.job f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
7c1ec43858.exeRegAsm.exe9cf13c5d16.exeRegAsm.exe9fd1a2f5ad.exef1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7c1ec43858.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9cf13c5d16.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fd1a2f5ad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exepid process 3068 f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe 3068 f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe 3860 explorti.exe 3860 explorti.exe 3980 explorti.exe 3980 explorti.exe 1928 explorti.exe 1928 explorti.exe 5628 explorti.exe 5628 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 1400 firefox.exe Token: SeDebugPrivilege 1400 firefox.exe Token: SeDebugPrivilege 1400 firefox.exe Token: SeDebugPrivilege 1400 firefox.exe Token: SeDebugPrivilege 1400 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 4768 RegAsm.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 1400 firefox.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exepid process 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe 4768 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 1400 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exeexplorti.exe7c1ec43858.exe9cf13c5d16.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 3068 wrote to memory of 3860 3068 f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe explorti.exe PID 3068 wrote to memory of 3860 3068 f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe explorti.exe PID 3068 wrote to memory of 3860 3068 f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe explorti.exe PID 3860 wrote to memory of 3632 3860 explorti.exe 7c1ec43858.exe PID 3860 wrote to memory of 3632 3860 explorti.exe 7c1ec43858.exe PID 3860 wrote to memory of 3632 3860 explorti.exe 7c1ec43858.exe PID 3632 wrote to memory of 4768 3632 7c1ec43858.exe RegAsm.exe PID 3632 wrote to memory of 4768 3632 7c1ec43858.exe RegAsm.exe PID 3632 wrote to memory of 4768 3632 7c1ec43858.exe RegAsm.exe PID 3632 wrote to memory of 4768 3632 7c1ec43858.exe RegAsm.exe PID 3632 wrote to memory of 4768 3632 7c1ec43858.exe RegAsm.exe PID 3632 wrote to memory of 4768 3632 7c1ec43858.exe RegAsm.exe PID 3632 wrote to memory of 4768 3632 7c1ec43858.exe RegAsm.exe PID 3632 wrote to memory of 4768 3632 7c1ec43858.exe RegAsm.exe PID 3632 wrote to memory of 4768 3632 7c1ec43858.exe RegAsm.exe PID 3632 wrote to memory of 4768 3632 7c1ec43858.exe RegAsm.exe PID 3860 wrote to memory of 3776 3860 explorti.exe 9cf13c5d16.exe PID 3860 wrote to memory of 3776 3860 explorti.exe 9cf13c5d16.exe PID 3860 wrote to memory of 3776 3860 explorti.exe 9cf13c5d16.exe PID 3776 wrote to memory of 1440 3776 9cf13c5d16.exe RegAsm.exe PID 3776 wrote to memory of 1440 3776 9cf13c5d16.exe RegAsm.exe PID 3776 wrote to memory of 1440 3776 9cf13c5d16.exe RegAsm.exe PID 3776 wrote to memory of 3608 3776 9cf13c5d16.exe RegAsm.exe PID 3776 wrote to memory of 3608 3776 9cf13c5d16.exe RegAsm.exe PID 3776 wrote to memory of 3608 3776 9cf13c5d16.exe RegAsm.exe PID 3776 wrote to memory of 3608 3776 9cf13c5d16.exe RegAsm.exe PID 3776 wrote to memory of 3608 3776 9cf13c5d16.exe RegAsm.exe PID 3776 wrote to memory of 3608 3776 9cf13c5d16.exe RegAsm.exe PID 3776 wrote to memory of 3608 3776 9cf13c5d16.exe RegAsm.exe PID 3776 wrote to memory of 3608 3776 9cf13c5d16.exe RegAsm.exe PID 3776 wrote to memory of 3608 3776 9cf13c5d16.exe RegAsm.exe PID 3860 wrote to memory of 4864 3860 explorti.exe 9fd1a2f5ad.exe PID 3860 wrote to memory of 4864 3860 explorti.exe 9fd1a2f5ad.exe PID 3860 wrote to memory of 4864 3860 explorti.exe 9fd1a2f5ad.exe PID 4768 wrote to memory of 4208 4768 RegAsm.exe firefox.exe PID 4768 wrote to memory of 4208 4768 RegAsm.exe firefox.exe PID 4208 wrote to memory of 1400 4208 firefox.exe firefox.exe PID 4208 wrote to memory of 1400 4208 firefox.exe firefox.exe PID 4208 wrote to memory of 1400 4208 firefox.exe firefox.exe PID 4208 wrote to memory of 1400 4208 firefox.exe firefox.exe PID 4208 wrote to memory of 1400 4208 firefox.exe firefox.exe PID 4208 wrote to memory of 1400 4208 firefox.exe firefox.exe PID 4208 wrote to memory of 1400 4208 firefox.exe firefox.exe PID 4208 wrote to memory of 1400 4208 firefox.exe firefox.exe PID 4208 wrote to memory of 1400 4208 firefox.exe firefox.exe PID 4208 wrote to memory of 1400 4208 firefox.exe firefox.exe PID 4208 wrote to memory of 1400 4208 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe PID 1400 wrote to memory of 4960 1400 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe"C:\Users\Admin\AppData\Local\Temp\f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\1000036001\7c1ec43858.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\7c1ec43858.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1900 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b13b1837-fc59-432f-b7d9-e70a9cc9ba4e} 1400 "\\.\pipe\gecko-crash-server-pipe.1400" gpu7⤵PID:4960
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a145889d-5543-4261-9f74-ce71c9495005} 1400 "\\.\pipe\gecko-crash-server-pipe.1400" socket7⤵PID:2988
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2740 -childID 1 -isForBrowser -prefsHandle 3244 -prefMapHandle 3324 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ade02d4e-7cf3-4a75-989e-5f4fc4fa7381} 1400 "\\.\pipe\gecko-crash-server-pipe.1400" tab7⤵PID:236
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3692 -childID 2 -isForBrowser -prefsHandle 3704 -prefMapHandle 3720 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08f05455-5025-45ae-b347-75758a5324b3} 1400 "\\.\pipe\gecko-crash-server-pipe.1400" tab7⤵PID:1576
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4744 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4716 -prefMapHandle 4648 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b507910-193a-4596-b202-0f2dee896d93} 1400 "\\.\pipe\gecko-crash-server-pipe.1400" utility7⤵
- Checks processor information in registry
PID:1600 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5608 -childID 3 -isForBrowser -prefsHandle 5668 -prefMapHandle 5664 -prefsLen 27181 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {716c9f4a-4767-469b-92d4-4d147146f409} 1400 "\\.\pipe\gecko-crash-server-pipe.1400" tab7⤵PID:1888
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5908 -childID 4 -isForBrowser -prefsHandle 5932 -prefMapHandle 5888 -prefsLen 27181 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8a0460f-5f22-44bb-b60d-6eb5adb0c562} 1400 "\\.\pipe\gecko-crash-server-pipe.1400" tab7⤵PID:1032
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5904 -childID 5 -isForBrowser -prefsHandle 5876 -prefMapHandle 5924 -prefsLen 27181 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11fe9f5f-44dc-42dc-a0e7-120b5f90bf28} 1400 "\\.\pipe\gecko-crash-server-pipe.1400" tab7⤵PID:2092
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6124 -childID 6 -isForBrowser -prefsHandle 6036 -prefMapHandle 5904 -prefsLen 27181 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6eb4d7a1-af44-485d-8ca2-8cbc62d71833} 1400 "\\.\pipe\gecko-crash-server-pipe.1400" tab7⤵PID:4852
-
C:\Users\Admin\1000037002\9cf13c5d16.exe"C:\Users\Admin\1000037002\9cf13c5d16.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:1440
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\1000038001\9fd1a2f5ad.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\9fd1a2f5ad.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4864
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3980
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1928
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5628
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD5023067031c6cfdf586bdad2cab514c6c
SHA1831efce5366ab12d5f63079d0767048b8333bfbf
SHA256f7de5cbeab4c68986a67448e0efa72b244ecd86eca1cc8bf373168b6fba454de
SHA51259c96c2b182702793abfd5d89b2572f27dc5275aafdc13b7b373e20910ea06d155532a28cc9d9339d0a5b3ea60c5aa7de57f74521ab3ea56122a51f39e006ccd
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9lt6socl.default-release\activity-stream.discovery_stream.json
Filesize41KB
MD55a2bdcba188b962c5c1dd4bad708c3cc
SHA16c4f9efb7c37f99858b46291d63a4dd2b4dc1477
SHA256b7f039471c05a4be7b6e827f167525ea44efb32546a6c568fc258f767ff6857f
SHA5120ece2b090607512481ef9c1253f75260b0ca46a26e06304bc4b25da6920746c9776e2574d83214ec99e76b4c780eb4d82fa0727681b4848b2f17181d589bf2c5
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9lt6socl.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD54fc85d5a3a7abb8bce56a20dba4620d3
SHA17dc3ec5bb890685ff89b5370ed70471fa30fa09d
SHA256d074b47bb4d9799c564fe0ea855f3fae36401e47e0bdb56199df7903de436c85
SHA5121682a488deca5f6783b3e541525c6ea52a7560669221a29af84024fe50047d4e5ca730b368797e6d21014754529b03a12441d2306903f39f675769986aef0604
-
Filesize
1.8MB
MD5f3ef6ea2a9629f605bb4c6bdd197b3e1
SHA1ffc67e08bf3897b3b6d8eb45150ddfab9d11ce96
SHA256f1460649ddf8662c8e5de0bde174b682f5743b780d4740c7d88385a3e72508a0
SHA5123e769090ab70a81bcf37e01701ff1e1f6081c3258e65dc25d16f19ac7804ffbbc0823229bc765465d0c7a7e24514524a9a007d6919a2fe098d6be026ac3c44c5
-
Filesize
1.2MB
MD5fdf21f3d12ad57882b440a836e1d34cd
SHA1989c59558befc0b36398f37ffebe3e7a1e547d7d
SHA2567a70259c92053fe11ab86abd7939df74094b9a62617d146eaeff3b1fbbdfa6af
SHA512dcca41ee0f1df37fc5deb762f272dd763f2078f404dc615973231e2f6d360b4a18e331be9060ae3b70337efc4484bfc5f13d7e2cc0d1fe57cbd309146425959c
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9lt6socl.default-release\AlternateServices.bin
Filesize10KB
MD5fd02776cfe5b83d999a6fead86963b40
SHA1ea9937953eb9adf90e31fc7005a860860f433a5a
SHA256e06c45122662f3262b46bdff9cd37faceb39e10d1f04c873253fea8c6c841731
SHA512329f2adc4da219dc37fae5161292ed9df57df6a055a8c9dd8f05efde1756915f25d8bb76d790170d9a15b3bddd74549787e413d55c09cff9ea894bacd0c1f4fc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9lt6socl.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD53aef27ad4c65ca2a3d1874f00fa2efc5
SHA148f95d692aead6f46db6802fa21b4bb884e6bfe8
SHA2562708a103af7b2fb948d812e393f37b84941f251adeb6be6fede08d2b0073df93
SHA5127a938c2c81c4bfbffd160c15b907288820c6126b6f9ee0d3d4f751931b41961c85022216c2222e1216e3034d0856310ad049651cff2ec9638e9afe8d22a33c06
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9lt6socl.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD57f0af93a27eff6d4a6ca21685b0bbbe1
SHA11a05afd72075ec4cd08840b93755a60b5df3404e
SHA256cedcfac186891b6342d3a50e2c26a08ed6824c7466e6994dce52efef251c1f2c
SHA51254a05e5ced17e4c2e56a8ee6ec1379fa2e723ab523fbd885f2b4142ce994c6ff5426ba252ec1933394e6260b1e9747e9370d52fa0ad4b16e7ea14495cec309e6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9lt6socl.default-release\datareporting\glean\pending_pings\464b4ea6-b00f-4fb8-82d9-0eace69e39c4
Filesize671B
MD59fd43cff4bdaf33f37d89ee1e829f434
SHA1a2b501b3f10a54fbdaaab20aa4bf54a5a2df60b2
SHA25654a30f5f6cbe31b9413812612563de13b3d6a05d2e1d36d96ad39784c2fd7497
SHA512760e44068e95a5c2bb58311b79a8b1df51d09ffe02037a000b36f03007f946d976577914c9eee1e656fe8fffd4bfb357f9910643d377f7d4b66508b3f3dd952d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9lt6socl.default-release\datareporting\glean\pending_pings\54bb9e2d-3c2b-43ae-8dd4-a3337afbf066
Filesize982B
MD5bdc9b86c1afa214a4b5e3d42fc216bbe
SHA1ed9fa3d2e893f1bf75559d2f364948fa7c38cfac
SHA2562435155b7f1640d50f9489e0420aa80555ba518aae02e35f765cb1d43af84753
SHA51211f1b149ea5dcbd442533cb3089c9a7bdbbcda7ba5d53290b3b04d67eeaef39d6abc1f8b64e07dd28fe99bf2ef4e88401038137466e4fd17500adbbaba2a7042
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9lt6socl.default-release\datareporting\glean\pending_pings\64c63e96-cb0a-45b3-ba70-102fa2a7220a
Filesize25KB
MD52e9d5bbfbe7137d97a29a3a80efcfd2f
SHA13e34dfc68736c4157e9088a7a559adea0fdf0e8a
SHA256dca7012c4e6281351c031086f31fae0eef5671e6bdce099ca49fc590d3ffac7f
SHA5126c889ce1880820c5dab35d9afc5e828de9ed7b6bb862c5ec47da19862123fb502022688f4fd3bc637679e0c94320122daeb6ada07544653674bac77007876556
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9lt6socl.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9lt6socl.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9lt6socl.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9lt6socl.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
13KB
MD59ac2b281a9a0dd9512a31eb98e7fd4d1
SHA1d7066478806c98f0d9cd5eeae3bca78eeb7e4b2c
SHA2560954fad58cb9ba03199e86d7bd8e79700454eceab25d3195ee941dc07e15b090
SHA5123acde40533c397528d8d19616e29112c73f1ea80ffa5340fee648ada2e540822644db99997f17c6745ab60846d223630f8b316e1349b5283a635a92368e68a1f
-
Filesize
16KB
MD56ddc947f1f32efdce7507a1229eb6b24
SHA176cd9387d17f492a5cc05507dfdc2b1d3ddb841e
SHA256c0a3212d236267e3437d794eef966244dda5064da0002fff1da4705c9e432f6b
SHA512372fd5e1f5589bee8cf92fc183fb73da9ce77166b7e6d7c6682554b123878dffba2d33390723b9ff248853f777c495f17192b5149b2c0c9a920c603bfe4e9531
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9lt6socl.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.6MB
MD568845be46584bfce9f3d5208eac40579
SHA131ca357030566c32c65764b2f0cd9a79b55157cb
SHA2568996eed9acef4f0d89a093584deee0631600c60e73e6a082decb7b7775124bc7
SHA512fcf7f3ec6522beb2b46bfb8f4f4611d2797a320ae76d17b7af63a02c8a138e2b52db627da3d6c4db8d6a1be671bfd0005ff12530661fc52c8bb607443a534d7e